4 ms·

WebTunnel

85 points by soheilpro 3y ago

etskinner 3y ago
Couldn't authoritarian regimes still block a blacklist of SSL certs, since those are sniffable? Or block the public list of bridge addresses?
- knowaveragejoe 3y ago
  If I understand correctly, there is no way for them to differentiate traffic using this vs legitimate HTTPS traffic. In other words, if a large, legitimate website was also serving a webtunnel behind their reverse proxy, the censoring regime would have to block all traffic to that domain, legitimate or not.
  - woofcat 3y ago
    Doubt it would happen but I'd love to see CloudFlare support this for all their domains. Blocking them is blocking 1/3rd of the internet.
    - dilyevsky 3y ago
      Cloudflare used to support domain fronting but they stopped doing that. Last i heard fastly still did
      - bauruine 3y ago
        Fastly blocked it two weeks ago. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42435 https://gitlab.torproject.org/tpo/applications/tor-browser/-...
        dilyevsky 3y ago
        Welp, not surprised given it's bad for their business. Guess hence the timing of this webtunnel thing - afaik tor was using fastly at least for their snowflake thing.
    - bauruine 3y ago
      You can run a webtunnel bridge behind Cloudflare. It also works behind AWS Cloudfront but that's just way too expensive if you don't get a reasonable rate from them like 99% reduction.
- bauruine 3y ago
  Yes they can block the domain if they find out it's used by a webtunnel bridge. Bridges aren't public that's the whole point of bridges. They are basically unlisted relays.
chatmasta 3y ago
Does this mean that, in theory, if you could compile the Tor library to WebAssembly then you could use it from inside a service worker in the browser?
- rendx 3y ago
  https://github.com/Ayms/node-Tor https://github.com/Ayms/node-Tor
mike_d 3y ago
The big win here is co-locating tunnels on existing domains with real websites. If anyone has a site that would be willing to host a tunnel but doesn't want to run a full tor bridge, email me (in my profile) and I can help you configure your server to forward traffic to my bridge. If you want to setup your own details are here: https://community.torproject.org/relay/setup/webtunnel/ https://community.torproject.org/relay/setup/webtunnel/
s4mw1se 3y ago
I’m an AppSec Engineer that works primarily on WebApps in eCommerce and none of this feels right to me. I became very skeptical of the Tor project when I found out that the CEO of CMYRU (data broker /threat intelligence for governments and large corporations) was on the Tor board. https://www.vice.com/en/article/z34jbj/tor-projects-moves-away-from-team-cymru-infrastructure https://www.vice.com/en/article/z34jbj/tor-projects-moves-aw... Privacy was incredibly hard 10 years ago, even harder 5 years ago, and it’s twice as hard today. All of the sudden a solution comes out that makes it easier using what? Modern day web apps and browsers? The things that are like pulling teeth out of a pit bull to secure unless everything was diligently threat modeled from start to finish before a line of code was written? If anyone has ever had the need to hide their IP address and be anonymous. It’s a real pain in the ass and takes a lot more OpSec then just using Tor. This seems like it’s just opening the door for MITM attacks between the web app and the tunnel.
- pabs3 3y ago
  Those MITM attacks could only block the Tor circuit, at which point, why run a tunnel just to block it?
- gruez 3y ago
  Your comment is baffling. You start off by expressing your displeasure at one of the board members, transition to talking about how privacy is "incredibly hard", and then vaguely implying that webtunnels have some sort of vulnerability? How are these related to each other?
  - s4mw1se 3y ago
    I’m expressing that my opinion is that the Tor board may not have the public users best interest at heart. I’m not implying that there is a vulnerability in WebTunnels. Just that the interface (Web Applications) is riddled with vulnerabilities and now less controlled. Compared to using something like the Tor Browser. WebApps are generally not open source. Intelligence agencies abuse vulnerabilities. CEO of Intelligence agency is on board. Not saying they will directly do anything but it’s hard to argue that the particular board member is acting in the best interest of privacy and could be swaying descsions to favor intelligence gathering

85 points by soheilpro 3y ago

Couldn't authoritarian regimes still block a blacklist of SSL certs, since those are sniffable? Or block the public list of bridge addresses?

knowaveragejoe 3y ago
If I understand correctly, there is no way for them to differentiate traffic using this vs legitimate HTTPS traffic. In other words, if a large, legitimate website was also serving a webtunnel behind their reverse proxy, the censoring regime would have to block all traffic to that domain, legitimate or not.
- woofcat 3y ago
  Doubt it would happen but I'd love to see CloudFlare support this for all their domains. Blocking them is blocking 1/3rd of the internet.
  - dilyevsky 3y ago
    Cloudflare used to support domain fronting but they stopped doing that. Last i heard fastly still did
    - bauruine 3y ago
      Fastly blocked it two weeks ago. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42435 https://gitlab.torproject.org/tpo/applications/tor-browser/-...
      - dilyevsky 3y ago
        Welp, not surprised given it's bad for their business. Guess hence the timing of this webtunnel thing - afaik tor was using fastly at least for their snowflake thing.
  - bauruine 3y ago
    You can run a webtunnel bridge behind Cloudflare. It also works behind AWS Cloudfront but that's just way too expensive if you don't get a reasonable rate from them like 99% reduction.
bauruine 3y ago
Yes they can block the domain if they find out it's used by a webtunnel bridge. Bridges aren't public that's the whole point of bridges. They are basically unlisted relays.

chatmasta 3y ago

Does this mean that, in theory, if you could compile the Tor library to WebAssembly then you could use it from inside a service worker in the browser?

rendx 3y ago
https://github.com/Ayms/node-Tor https://github.com/Ayms/node-Tor

mike_d 3y ago

The big win here is co-locating tunnels on existing domains with real websites. If anyone has a site that would be willing to host a tunnel but doesn't want to run a full tor bridge, email me (in my profile) and I can help you configure your server to forward traffic to my bridge. If you want to setup your own details are here: https://community.torproject.org/relay/setup/webtunnel/ https://community.torproject.org/relay/setup/webtunnel/

s4mw1se 3y ago

I’m an AppSec Engineer that works primarily on WebApps in eCommerce and none of this feels right to me. I became very skeptical of the Tor project when I found out that the CEO of CMYRU (data broker /threat intelligence for governments and large corporations) was on the Tor board. https://www.vice.com/en/article/z34jbj/tor-projects-moves-away-from-team-cymru-infrastructure https://www.vice.com/en/article/z34jbj/tor-projects-moves-aw... Privacy was incredibly hard 10 years ago, even harder 5 years ago, and it’s twice as hard today. All of the sudden a solution comes out that makes it easier using what? Modern day web apps and browsers? The things that are like pulling teeth out of a pit bull to secure unless everything was diligently threat modeled from start to finish before a line of code was written? If anyone has ever had the need to hide their IP address and be anonymous. It’s a real pain in the ass and takes a lot more OpSec then just using Tor. This seems like it’s just opening the door for MITM attacks between the web app and the tunnel.

pabs3 3y ago
Those MITM attacks could only block the Tor circuit, at which point, why run a tunnel just to block it?
gruez 3y ago
Your comment is baffling. You start off by expressing your displeasure at one of the board members, transition to talking about how privacy is "incredibly hard", and then vaguely implying that webtunnels have some sort of vulnerability? How are these related to each other?
- s4mw1se 3y ago
  I’m expressing that my opinion is that the Tor board may not have the public users best interest at heart. I’m not implying that there is a vulnerability in WebTunnels. Just that the interface (Web Applications) is riddled with vulnerabilities and now less controlled. Compared to using something like the Tor Browser. WebApps are generally not open source. Intelligence agencies abuse vulnerabilities. CEO of Intelligence agency is on board. Not saying they will directly do anything but it’s hard to argue that the particular board member is acting in the best interest of privacy and could be swaying descsions to favor intelligence gathering